Question 1

Is a fleet operator a data fiduciary under the DPDP Act?

Accepted Answer

Yes, in almost every case. A Data Fiduciary is whoever determines the purpose and means of processing personal data. The operator decides that drivers will be tracked, at what frequency and for what purpose, so the operator is the fiduciary and the telematics or fleet platform is a processor acting on its behalf. Section 8(1) makes the fiduciary responsible irrespective of any agreement to the contrary, which means a vendor contract cannot shift that status.

Question 2

Can we rely on the consent our drivers signed at onboarding?

Accepted Answer

Treat it as a weak ground rather than a solved problem. Section 6(1) requires consent to be free and unconditional, and a candidate signing a tracking form alongside their employment contract is not obviously giving it freely. Section 7(i) allows processing for the purposes of employment or to safeguard the employer from loss or liability, which is a sturdier basis for operational tracking — provided every data point maps to a real employment purpose.

Question 3

How long can we keep a driver's location history?

Accepted Answer

The Rules prescribe no period for a fleet. Rule 8(1) attaches a fixed retention clock only to the classes in the Third Schedule — large e-commerce entities, online gaming intermediaries and large social media intermediaries. Section 8(7) still requires erasure once the specified purpose is no longer served, so a fleet has to set defensible periods per data class: a short window for raw GPS, payroll-length retention for trip summaries, and de-identification for anything kept for long-run analytics.

Question 4

Does AIS-140 tracking fall under the DPDP Act as well?

Accepted Answer

The two govern different things. AIS-140 mandates a vehicle location tracking device and a feed to the state command-and-control centre for permit-holding vehicles; it says nothing about how the operator may use its own operational data. The Act governs that operational stream — the location traces, behaviour scores and charging records the business runs on — which is where a fleet's duties as a Data Fiduciary actually bite.

Question 5

What must our contract with a fleet software vendor say?

Accepted Answer

Four things: that the vendor processes driver data only on your instructions and for your purposes; that it meets the rule 6(1) security floor, including the express safeguards provision the rule requires in the contract itself; that it notifies you of a breach within a fixed number of hours, tight enough for you to meet your own seventy-two-hour duty to the Board under rule 7; and that it deletes driver personal data on exit, after giving you a usable export.

data protection india

DPDP Act Compliance For Fleets: What Your Drivers’ Tracking Data Now Requires